Companies worried for years about whether an employee’s password had been stolen.
Now they have to worry about AI “workers,” too.
Okta (OKTA) reported fiscal second-quarter revenue of $805 million, up 11%, while subscription revenue reached $793 million, up 12%. Remaining performance obligations increased 17% to nearly $4.86 billion.
The company boosted its yearly outlook as organizations increasingly face a category of identity that was virtually nonexistent in mainstream commercial IT only a few years ago: autonomous AI agents.
“Every agent needs a trusted identity and clear controls over what it can access and do,” CEO Todd McKinnon said.
For the average worker, the future isn’t science fiction. Allowing artificial intelligence to read emails, update customer records, query databases, and trigger corporate processes is becoming more common.
The more power these systems have, the more dangerous a compromised agent can become.
Okta helps govern rising number of digital workers
This issue was a problem businesses were tackling long before autonomous AI took off.
A CyberArk study found that 79% of firms anticipate machine identities growing in the coming year. Almost two-thirds expected growth of up to 50%, with another 16% expecting increases of between 50% and 150%.
AI agents only accelerate that tendency because each autonomous system may need its own authentication credentials, permissions, and audit trail.
If a corporation has an employee in accounting, that company may prohibit them from downloading a complete engineering database.
AI agents should be restricted in the same way.
Related: Cybersecurity stocks in spotlight as U.S. vulnerability takes center stage
Earlier this year, Okta released Okta for AI Agents, which is now generally available. The software is designed to find AI agents, enforce least-privilege access, and centrally manage what agents may do.
That creates an entirely new potential security category. Companies may no longer merely pay for Okta to help manage every human employee. They may eventually pay to govern armies of digital workers as well.
Bloomberg / Getty Images
AI agents turn convenience into risk
The promise of an agent is that users stop doing every step themselves.
An AI agent might read a client complaint, go into the CRM, issue a refund, change inventory, and send a reply. It’s super valuable if the agent is allowed to take each step.
More AI:
- Nvidia just made a move Wall Street wasn’t ready for
- Microsoft just took sides in AI policy fight
- OpenAI just disclosed something genuinely alarming
The same autonomy becomes harmful if the agent influences, compromises, or just makes a mistake.
Verizon’s 2026 breach research indicated that shadow AI usage had risen to 45%, increasing the risk of data loss. Software vulnerability exploitation was the cause of 31% of first access in breaches. AI automation was speeding up the attacks.
IBM says the average hack today costs more than $5 million globally, and some attacks on AI models are far more costly.
Those economics help explain the resonance of Okta’s pitch.
The company produced $234 million of operating cash flow and $227 million of free cash flow during the quarter, while current remaining performance commitments grew 14% to $2.585 billion.
Okta’s AI-security setup
- Q2 revenue: $805 million
- Subscription revenue: $793 million
- Subscription backlog/RPO: About $4.86 billion
- cRPO: $2.585 billion
- Operating cash flow: $234 million
- Free cash flow: $227 million
- Full-year revenue outlook: Roughly $3.22 billion to $3.23 billion
- Emerging growth category: AI-agent identity security
Why Okta’s new security problem reaches Main Street
Most individuals don’t know they are buying identity-security software.
They are always talking to it.
An identity-management system can house all of these: the login verification when an employee accesses payroll, the authentication request before customer data opens, and the security rule that bans anomalous access.
That unseen layer becomes even more critical with AI agents. Feed an AI assistant customer credit-card details or medical records, and it can cause serious problems through bad permissions.
For ordinary consumers, that means the security question shifts from “Who has access to my data?” to “What has access to my data?”
Wall Street saw the possibilities, pushing Okta shares substantially higher after the company’s performance and forecast topped expectations, the Wall Street Journal reported.
The issue is that AI-agent security is still in its infancy. Companies may take longer than providers anticipate to implement agents, or huge software platforms may package identity controls right into their offerings.
But for agents to become true digital employees, they need what every employee already has: an identity, a badge, and restrictions on which doors they can open.
Okta wants to sell all three.
Related: Here's how the Okta data hack was much worse than the company originally said
